<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="content-type"> <title>security bug forum chat</title> </head> <body> <span style="font-family: monospace;">tacitus - 2006/06/17 05:48 </span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">I'm all for healthy competition and needling each other. I think</span><br style="font-family: monospace;"> <span style="font-family: monospace;">anyone who knows me knows I'm anything but thin-skinned.</span><br style="font-family: monospace;"> <span style="font-family: monospace;">I enjoy a good romp either on gjs or on justrage, or whatever.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">This thing, though, crossed the line between rough play</span><br style="font-family: monospace;"> <span style="font-family: monospace;">and actual harm.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">I figured Tacitus would be insufferably smug if he found</span><br style="font-family: monospace;"> <span style="font-family: monospace;">the bug he was looking for, but I figured that was a small</span><br style="font-family: monospace;"> <span style="font-family: monospace;">price to pay for getting help securing DS. What I did</span><br style="font-family: monospace;"> <span style="font-family: monospace;">not count on was him taking it upon himself to delete</span><br style="font-family: monospace;"> <span style="font-family: monospace;">log files.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">This is a serious problem, because he was messing with</span><br style="font-family: monospace;"> <span style="font-family: monospace;">security, and if I can't tell what he did, I have to</span><br style="font-family: monospace;"> <span style="font-family: monospace;">stop everything and reconstruct the events by hand.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">Whether it was malicious is actually beside the point.</span><br style="font-family: monospace;"> <span style="font-family: monospace;">Either he's untrustworthy because he was concealing bad</span><br style="font-family: monospace;"> <span style="font-family: monospace;">behavior, or he's untrustworthy because he doesn't know</span><br style="font-family: monospace;"> <span style="font-family: monospace;">better than to tromp around someone's logs as he pleases,</span><br style="font-family: monospace;"> <span style="font-family: monospace;">without so much as a hint of his intentions to the</span><br style="font-family: monospace;"> <span style="font-family: monospace;">owner.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">Either way, it was a breach of trust I did not expect</span><br style="font-family: monospace;"> <span style="font-family: monospace;">from someone I've been supporting as a leader in the</span><br style="font-family: monospace;"> <span style="font-family: monospace;">community.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">I've been granted guest creator and sometimes even guest</span><br style="font-family: monospace;"> <span style="font-family: monospace;">admin privileges on other people's muds, and I have</span><br style="font-family: monospace;"> <span style="font-family: monospace;">never done anything but exactly what I've announced</span><br style="font-family: monospace;"> <span style="font-family: monospace;">and only with permission, because it's not my mud</span><br style="font-family: monospace;"> <span style="font-family: monospace;">and I understand that. This is basic. It's obvious.</span><br style="font-family: monospace;"> <span style="font-family: monospace;">In someone else's house, you ask before you perform</span><br style="font-family: monospace;"> <span style="font-family: monospace;">potentially irreversible changes, or you can just</span><br style="font-family: monospace;"> <span style="font-family: monospace;">consider yourself a boor.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">So there's that.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">According to Tacitus he attempted to delete logs without</span><br style="font-family: monospace;"> <span style="font-family: monospace;">asking permission out of a concern that other people</span><br style="font-family: monospace;"> <span style="font-family: monospace;">might happen upon them and learn the exploit. Aside</span><br style="font-family: monospace;"> <span style="font-family: monospace;">from the obvious objection that he could have just</span><br style="font-family: monospace;"> <span style="font-family: monospace;">told me so I could decide for myself, is the bizarre</span><br style="font-family: monospace;"> <span style="font-family: monospace;">fact that he went on gjs intergossip to announce there</span><br style="font-family: monospace;"> <span style="font-family: monospace;">his achievement, and allowed thespread of information about how</span><br style="font-family: monospace;"> <span style="font-family: monospace;">he did it. Any casual reader of the gjs i3 log is</span><br style="font-family: monospace;"> <span style="font-family: monospace;">now in full possession of all the details needed to</span><br style="font-family: monospace;"> <span style="font-family: monospace;">compromise a Dead Souls mud, if given Creator status.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">How this squares with his stated intention of protecting</span><br style="font-family: monospace;"> <span style="font-family: monospace;">the community by deleting my logs I can't say.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">There are some folks out there who find exploits in</span><br style="font-family: monospace;"> <span style="font-family: monospace;">commercial software, and share the information</span><br style="font-family: monospace;"> <span style="font-family: monospace;">with the public in an attempt to help people get</span><br style="font-family: monospace;"> <span style="font-family: monospace;">ahead of the curve. Even assuming this is not</span><br style="font-family: monospace;"> <span style="font-family: monospace;">dangerous, it is common for professional, responsible</span><br style="font-family: monospace;"> <span style="font-family: monospace;">programmers who find serious flaws to give the</span><br style="font-family: monospace;"> <span style="font-family: monospace;">manufacturer a few days or weeks to develop a</span><br style="font-family: monospace;"> <span style="font-family: monospace;">patch before outing the info. As a colleague, this</span><br style="font-family: monospace;"> <span style="font-family: monospace;">is the least I would have expected.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">Instead I'm now spending what little of the weekend</span><br style="font-family: monospace;"> <span style="font-family: monospace;">I had for myself reconstructing free space to</span><br style="font-family: monospace;"> <span style="font-family: monospace;">find potentially deleted files, and exhaustively</span><br style="font-family: monospace;"> <span style="font-family: monospace;">nailing down each exploit and subexploit related to</span><br style="font-family: monospace;"> <span style="font-family: monospace;">this incident. Just because Tacitus couldn't contain</span><br style="font-family: monospace;"> <span style="font-family: monospace;">his glee and pride at rooting me, and couldn't</span><br style="font-family: monospace;"> <span style="font-family: monospace;">give me a couple of days to deal with it</span><br style="font-family: monospace;"> <span style="font-family: monospace;">in a more deliberate and measured way.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">Well, Tacitus, you win. The big bad Dead Souls</span><br style="font-family: monospace;"> <span style="font-family: monospace;">juggernaut had feet of clay, after all.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">However, you've lost any trust I had in you, any</span><br style="font-family: monospace;"> <span style="font-family: monospace;">good will. Maybe it will change, but at the moment</span><br style="font-family: monospace;"> <span style="font-family: monospace;">I just don't see myself feeling up to dealing</span><br style="font-family: monospace;"> <span style="font-family: monospace;">with you. You didn't have to do it this way.</span><br style="font-family: monospace;"> <span style="font-family: monospace;">I hope the schadenfreude was worth it.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">When you came back from watching your</span><br style="font-family: monospace;"> <span style="font-family: monospace;">movie, this was your message:</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">Tacitus@TimMUD <intergossip> How is that audit coming?</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">It's coming along fine. Thanks.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">-Crat</span><br style="font-family: monospace;"> <span style="font-family: monospace;"> </span><br style="font-family: monospace;"> <hr style="width: 100%; height: 2px; font-family: monospace;"><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">Re:tacitus - 2006/06/17 06:00</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">I think Cratylus made some very valid points however I think we all know that I wasn't trying to be malicious - I was simply excited by my discovery. Furthermore, you told me you were snooping and then I paged the log file and then proceeded to delete (However, either the access file hadn't reparsed or you had already removed me from the arch group so it failed) the log file that contained the commands (eval and call logs) I used to find the exploit. From today's events, I can only conclude we didn't truly realize the lack of trust we had in each other in the first place or you are trying to use this as some sort of publicity stunt.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">As for the information being released on intermud, I did not release the information directly. Rather Duuk was cleaver enough to pry enough out of him to figure it out on his own and then proceed to make fun of you - I can see how your feelings can be a bit hurt.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">I know if this happened to my lib, I'd be very much embarassed too and I can understand why you are making this post. I humbly appologize.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">P.S. The audit comment was to Hellmonger because he joking said that he'd audit my mudlib for me. If you know this and that means that you are now auditing my mudlib, I look forward to the results.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">Post edited by: somerville32, at: 2006/06/17 06:02 Tacitus</span><br style="font-family: monospace;"> <span style="font-family: monospace;">Executive Director</span><br style="font-family: monospace;"> <span style="font-family: monospace;">Research, Education, and Development</span><br style="font-family: monospace;"> <span style="font-family: monospace;">LPUniversity Foundation</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <hr style="width: 100%; height: 2px; font-family: monospace;"><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">Re:tacitus - 2006/06/17 06:18 </span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">For the record, I don't remember saying anything about</span><br style="font-family: monospace;"> <span style="font-family: monospace;">watching you. While you were messing with my lib, I was</span><br style="font-family: monospace;"> <span style="font-family: monospace;">in the middle of helping Samael. That was the level of</span><br style="font-family: monospace;"> <span style="font-family: monospace;">trust I had in you. When you started crowing about your</span><br style="font-family: monospace;"> <span style="font-family: monospace;">success, I started snooping you, and saw you trying</span><br style="font-family: monospace;"> <span style="font-family: monospace;">to delete logs. You can imagine my dismay. Given</span><br style="font-family: monospace;"> <span style="font-family: monospace;">that you were admin, were deleting logs without telling me,</span><br style="font-family: monospace;"> <span style="font-family: monospace;">and I didn't know what you'd do next, I ridded you on the spot</span><br style="font-family: monospace;"> <span style="font-family: monospace;">and locked the mud, but alas, you'd already made yourself</span><br style="font-family: monospace;"> <span style="font-family: monospace;">an elder, so you recreated your character and logged back</span><br style="font-family: monospace;"> <span style="font-family: monospace;">in. Not knowing what you *had* done or what you *planned*</span><br style="font-family: monospace;"> <span style="font-family: monospace;">to do, I killed the mud process, unmounted the filesystem,</span><br style="font-family: monospace;"> <span style="font-family: monospace;">and began the tedious process of intrusion forensics.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">You really don't need to suggest I feel hurt because of Duuk.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">I feel betrayed because of *you*.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">You seem intent on provoking me by claiming that my</span><br style="font-family: monospace;"> <span style="font-family: monospace;">statements are for some purpose other than telling the truth.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">I would suggest you read my statements as declarations</span><br style="font-family: monospace;"> <span style="font-family: monospace;">of what I believe to be true, regardless of how uncomfortable</span><br style="font-family: monospace;"> <span style="font-family: monospace;">that might make you.</span><br style="font-family: monospace;"> <br style="font-family: monospace;"> <span style="font-family: monospace;">-Crat</span><br style="font-family: monospace;"> </body> </html>
